AVFUELER Web Page

Controlling Carbon Monoxide Hazard in Aircraft Refueling Operations

Investigators from the National Institute for Occupational Safety and Health (NIOSH) conducted an evaluation of the occupational health hazards to workers who fuel jet aircraft. During the investigation, we learned that two workers had died in or near their refueling vehicles. Although carbon monoxide (CO) poisoning was not suspected at the time of the deaths, a combination of the unusual location of the engine exhaust (under the front bumper), the deterioration of rubber seals (boots) around the gear shift lever and the pedals, and the fact that the workers spend a considerable amount of time sitting in idling vehicles (especially during poor weather), led us to measure CO levels in the truck cabs. Dangerous concentrations of CO were found. The company involved instituted maintenance procedures and work practice rules requiring that the windows be kept open whenever the truck is occupied. However, recent spot checks suggest that many operators of airport refueling services are unaware of the risk, and therefore have not taken precautions to prevent dangerous concentrations of CO.

Carbon monoxide is a colorless, odorless gas which limits the ability of the blood to carry oxygen to the tissues. Symptoms of acute CO poisoning include headaches, rapid breathing, nausea, weakness, dizziness, confusion, hallucinations, and discoloration of the lips or nail beds. If the exposure level is high, loss of consciousness may occur without other symptoms. Death may result from depression of the functions of the brain, or if there is underlying coronary artery disease, from heart attack. Because CO remains in the blood for several days, there may be a gradual increase in body levels of CO over the course of a work week. Effects of chronic exposure are not completely known.

The combination of methods used to control CO exposure may vary from one location to another, and care must be taken to assure that the principles and laws of fire safety are not violated; some recommendations by NIOSH for controlling dangers of CO are listed below.

To minimize generation of CO, trucks should be converted to electric or diesel power. While generating less CO, the stronger odor of diesel exhaust also provides better warning properties than does the odor of gasoline exhaust.
Refueling trucks should be maintained so that entry of CO from beneath the cab is prevented. Rubber boots around pedals and levers should be intact, with tight fittings; grommets in holes through the firewall should fit snugly; rust holes in the floor pans or elsewhere should be closed; heater and fresh air intakes should be remote from the exhaust discharge; and exhaust systems should be checked regularly and tightened or replaced whenever leaks are suspected.
Engines should be well-tuned since proper fuel-to-air ratios will reduce the amount of CO produced.
There should be installed in the cab a continuous CO monitor with alarm to warn the operator before the concentration of CO becomes dangerous.
Workers should be provided access to waiting areas, which are as comfortable as the truck cabs; they should be required to vacate the cabs when not engaged in operating the vehicle.
Workers engaged in fueling operations should be encouraged to refrain from smoking because smoking elevates blood levels of CO enough to reduce margins of safety.
Interim work rules requiring that windows be kept open whenever the cab is occupied, and that vehicles be parked with the exhaust downwind from the air intake, while prudent, cannot be relied upon as long-term solutions. Under some circumstances, for example, CO concentrations could be higher with windows open, and positioning of the truck may be restricted by aircraft parking arrangements. Wiring the ventilation fan to operate whenever the engine is running, will usually build a positive pressure in a closed cab and minimize seepage-in of CO; however, in some circumstances such an arrangement might actually draw CO into the vehicle.

We are requesting the assistance of airport managers and editors of appropriate trade journals in bringing this information to the attention of fueling service operators. Oil companies may, through their routine inspection services provided to operators, be especially effective in controlling the risk.

Suggestions, requests for information on control practices, or questions related to this announcement, should be directed to the Division of Standards Development and Technology Transfer, National Institute for Occupational Safety and Health, 4676 Columbia Parkway, Cincinnati, Ohio 45226, telephone (513) 684-8302.

GSE Expo 2000 Conference Report: Fuel Handling & Safety on the Ramp

Places of Peril

Martin Lamprecht attended the Fuel Handling & Safety on the Ramp seminar in Las Vegas and discovered that the two are clearly connected.

Three billion U.S. Dollars in damage are caused by airport ground vehicles hitting aircraft, each other, and other unforgiving objects around the airport. These costs are high even on a global scale, but much worse is the potential for serious injury or loss of life. While the GSE Expo seminar on ramp safety and refueling emphasized the importance of vigilance and warned of the dangers of complacency, another tragic ramp accident happened an ocean away from Las Vegas.

Frankfurt Airport ramp crews witnessed a horrible fatal accident during an aircraft pushback operation at the end of October. A large tow tractor had just had its towbar uncoupled from the aircraft nose landing gear and was moving back with the driver in the cab at the front of the vehicle. The ramp agent in charge had just raised her hand for the "all clear" signal to the aircraft, turned and started to walk away, when she was hit by the reversing tow tractor. The force of the impact threw her to the ground and under the moving tractor. The driver was alerted to the collision only through calls from ramp personnel nearby. The body of the ramp agent could only be recovered after the tractor had been lifted off the ground by a crane. A tragic accident and a reminder of how dangerous the ramp is as a workplace when communication and visual contact are lost among ground staff.

The cost of safety infractions are high indeed, as Stuart Matthews, Chairman, President and CEO of the Flight Safety Foundation (FSF) demonstrated at the conference with the help of some eye-opening statistics. His non-profit organization acts independently of operators and industry suppliers in the interest of safer flight and ground operations worldwide. The FSF has long recognized that flight safety is not just a matter of safe flight, but also involves safe ground operations by aircraft, ground vehicles and the people that operate them.

"We believe that safety is the sum of all the parts," Matthews emphasized. Awards play an important role in the work of the group, with the Air BP Ramp Safety Award, for example, being a highly visible achievement in the industry.

Analysis of aircraft accidents has shown that they are almost always the result of a chain of events and 85 percent of the time are influenced by human error. Aviation safety has improved dramatically over the past decades. At the beginning of the jet era around 1960, the worldwide commercial jet fleet suffered over 26 accidents per million departures annually. This number has now dropped down to 1.3 accidents per million departures annually worldwide (the US accident rate is only 0.3 per million departures). Still, the annual insured value of all crashed airframes, commercial and general aviation, amounts to an average of $1 billion.

"Most accidents happen on the ground, but interestingly they are not considered to be part of aviation safety but industrial accidents," revealed Matthews. Data for such incidents is often difficult to obtain and, in many cases, staff involved in such situations are not airline employees, but work for airports or contractors on airports. Matthews stressed that airlines must be responsible for contractor services.

The air transport industry is not doing well in terms of safety incidents when compared to other industries. In the U.S., the lost-workday incidents rate per 100 employees showed an industry average of 1.9 for 1998. The corresponding numbers were 3.2 for the construction industry, considered to be a high risk work place, and a staggering 8.2 for the air transport sector. DuPont, a company the FSF works closely with in developing workplace safety guidelines, manages a low 0.03 rate of lost workday incidents per 100 employees.

The direct cost of property damage and personal injury are more obvious than the indirect costs that are related to each incident. Indirect costs include lost revenue, lost work time, disruption of flight schedule, and negative customer reaction to accidents. The FSF quotes costs from real life incidents, such as the damage caused by a catering truck hitting an airplane. The direct cost was $17,000, but the indirect cost amounted to $230,000. Matthews calculated that the indirect cost typically reaches four times the value of the initial direct costs.

Matthews argued that it is not just the line person who makes mistakes that lead to an accident, it is more often failures caused by the organizational outlook of a company. This includes improper training and providing inappropriate facilities, equipment and other resources. "If you are trying to make do on a shoestring [budget], you are sometimes compromising safety," he added.

Jim Swartz, Director, Corporate Safety at Delta Air Lines in Atlanta, provided an example on the role of partnerships for safety among on the ramp. He is a key member of Delta's Underwing Partners Safety Leadership Team (see GSE Today, October 200, page 52).

As Swartz pointed out, Delta has over 8,000 pieces of ground support equipment, burning about 6,000 gallons of fuel per minute during the work day. The Delta executive stressed that safety is often a very generic term that means different things to different people. It is important, he said, to understand and analyze the entire process of the operation and define critical elements that affect safety.

Once a safe process has been defined, "I need to apply this process to every flight, every day. There is much discipline involved. Discipline is not about firing people, it is about recognizing excellence."

One of the most important efforts to create a safety culture and a safe ramp environment is to get people involved and make the word "safety" come alive, according to Swartz. Safety is big business, he added. At Delta, the average aircraft damage runs anywhere from $150,000 and up.

Partnership between the airline and the equipment and service suppliers has been formalized at Delta with the Underwing Partners Safety Leadership Team. There is a Safety Business Plan that defines what the members of the Underwing group expects of each other. It is re-defined every year to determine what a safe operation is. The group provides a certain degree of common safety culture through this close cooperation. It also gives suppliers a kind of "seal of approval" that gives them a strong advantage when bidding for contracts at the airline.

Safety goes beyond the adherence to Standard Operating Procedures. Dealing with flammable, volatile substances in an already dangerous environment, as fueling companies do, requires a corporate commitment to a quality culture, in order to provide a dependable service in a safe manner.

Stressed Brian Hahle, Operations Engineer - Quality Assurance at Air BP: "There is not a single operation that handles fuel that doesn't need a commitment to quality. It needs to start at the top and resonate all the way down. The people need to feel that there is a commitment to quality within that organization."

The quality culture is also reflected in the type of equipment and the facilities used by companies, and how they maintain it, he added. "It all boils down to an attitude … if the commitment to quality is there, then a fueling company can truly be successful."

Product knowledge of fueling staff is obviously a very important ingredient for a safe operation, making sure that the right type of fuel is delivered for use in the appropriate vehicle and aircraft. This is aided by the refineries colorizing fuels in accordance with their octane ratings.

The quality control chain, as Hahle elaborated, comprises the facilities and equipment, product tests, daily procedures supporting documentation, and staff training, that runs in parallel with the distribution chain. Together, they insure that the oil companies deliver clean and on-specification fuels into aircraft safely and cost effectively.

The major threats to fuel quality were identified as: dirt and water, unwanted additives, aging of product, transportation methods, poor facility design (with poor flushing capabilities), and other fuels such as jet fuel getting into avgas storage tanks. Water left in storage tanks can cause microbial growth and result in serious contamination problems.

"The bottom line is complacency," stated Hahle. "People need to know that every time they receive product into storage, that there are certain things they need to do." Thorough staff training is a very important basic requirement that helps alleviate risks in fuel handling and to maintain consistent fuel quality. Hahle pointed out that a variety of training manuals and interactive CD ROMs are available and also complemented the Safety First training courses offered for supervisors by the National Air Transportation Association (NATA).

Larry Fleming, Regional Sales Manager of Facet USA, talked about the issues of fuel filtration using modern disposable paper filters that help keep fuels clean and safe to use. Facet offers different filtration options, including Micronic Filtration cartridges, Screwbase Prefilters, and clay treaters, depending on the indented use and equipment.

"What we are is finding the symptom that indicates the presence of a 'disease'. We have a sample of the fuel, blended with distilled water and put it through a loop with fiberglass, like the ones found in a coalescor. So, it should come out coalesced, if it does not you know that there is a Surface Active Agent there. We found the symptom that indicates the presence of a disease," explained Fleming.

Mike Mooney, Vice President of Sales and Technical Services of Valley Oil Company, talked about the dangers and prevention of misfueling, in particular with jet fuel and avgas. Mooney related to many cases where a lack of checks and appropriate training led to engine damage, fires and component damage.

"Placing jet fuel into aircraft with reciprocating engines is the one that makes the most headlines and placing avgas into aircraft requiring jet fuel," stated Mooney. The use of avgas in helicopters, while considered by many pilots as being acceptable, has lead to many cases of engine failure that forced emergency landings.

"What happens when you introduce jet fuel or diesel fuel or heavier fuel into a gasoline powered engine is a phenomenon called detonation," Mooney explained. "While one cylinder may be operating correctly, another cylinder that should be in the compression stroke, not quite at the top dead center where the spark plug would fire that mixture, will ignite on its own. The results are excessive heat and forces on the engine and this can cause severe damage."

Mooney referred to one tragic case where two people lost their lives because of misfueling. A new line person overseeing fuelling had placed jet fuel into the tanks of an aircraft that required avgas. It was a case where an inexperienced fueling operator had fueled a Cessna 421 with the wrong type of fuel, mistaking the aircraft for a jet fuel burning Cessna Conquest. A minute after take off, the pilot reported a problem and advised that he had to return to the airport immediately. The aircraft did not make it back to the field and crashed, killing both pilot and passenger.

In the NTSB report, the line person stated that he had fueled the plane with low lead fuel, while a co-worker stated that he saw his colleague drive the jet fuel truck. That second person also reported seeing white clouds of smoke coming from the taxiing aircraft before it took off and crashed.

"There were a couple of things here that could have gone a little bit differently and saved these peoples' lives," stressed Mooney. "There is a low tech device that could have saved the day here. The aircraft had fuel restrictors installed on the fuel tank openings. When they looked at the fuel truck, it did not have the wide blade, or 'duck bill' nozzle. The nozzle had been in the warehouse for two years."

There are some tragic consequences from misfueling ground support vehicles as well, as Mooney continued. "One of the most common things that we find is that people like to use avgas for ground support equipment. If you are doing it - please stop!" Mooney pointed out that, firstly, it is against the law, as it is a leaded fuel. One inspector in California came onto an airfield in that state and found the operator there using jet fuel and avgas in their ground support equipment and handed out a substantial fine. Mooney added that the same inspector now has made a career of going around airports in California and checking the type of fuels used in GSE.

Avgas is also a highly aromatic fuel with a lot of lead, not designed for use in a normal, automotive style engine. "The components in the fuel system are not compatible and, typically, the result is a fuel leak, almost always in the engine compartment adjacent to the exhaust manifold. You've got the stage set for a fire." Avgas has a high lead content, even though it is termed Low Lead. That lead is something low compression engines can not handle, creating lead deposits on the valves and cylinder heads which cause a 'heat focus', as Mooney explained. The result is severe damage to the engine. Large, visible stickers should be used to alert fuelers to the type of fuel a certain vehicle requires, suggested Mooney.

Mooney talked to a number of GSE manufacturers to ask whether users were putting the wrong type of fuel into storage tanks or vehicles. The response was, "all the time", including gasoline in hydraulic fluid reservoirs. One of them observed a ramp person entrusted with vehicle fueling trying to put the fueling nozzle into the exhaust pipe of an aircraft engine pre-heater. In his earlier days in business, Mooney discovered that one of his co-workers had filled up the lav cart's 'blue water' tank with gasoline. "This was back in the days when people smoked on airplanes, and I always wondered what would have happened....".

There are a number of high tech solutions to fueling problems, such as the Automated Fleet Fueling System offered by Scully Signal Company. It comprises a device installed at the fueling point of a vehicle or aircraft that communicates with the fueling equipment to prevent the operator from putting the wrong fuel into a vehicle or aircraft. The programmable system can also be used to give more details about the vehicles that are equipped with the device, including preventative maintenance issues like oil change schedules.

To illustrate the dangers of complacency when doing a job that has become routine, Larry Fleming showed a photograph of a beaver that was hit and killed by a tree that it had just chopped down for its dam. Murphy's Law is real, after all.

RAMP OPERATIONS (General Safety)

The ramp is a potentially hazardous area and safety must be your prime consideration when conducting activities in this area. The ramp is a location where considerable activity may be present as aircraft are taxied on and off the ramp and pilots and mechanics preflight and repair aircraft.

Since aircraft are continually starting, shutting down, and taxiing in the ramp area, noise is generated from many different directions. Therefore, it is important that you utilize your eyes as well as your ears in maintaining extreme vigilance.

Always approach an aircraft with caution and respect the prop as if it could start at any time. Give all aircraft that are occupied or being fueled a wide berth by walking cautiously about it. Never run on the ramp as the time span to recognize a hazard is shortened. Give the ramp area the attention it deserves and you won't become a ramp accident statistic.

AIRCRAFT ACCIDENTS

Date: 19 Jan. 2003 - Airline: Northwest Airlines - A/C: Airbus A319-114 - Location: Flushing, New York - Fatalities: 0:3

The aircraft was being taxied from the maintenance area to the gate for a flight at approximately 6:25am local time. Two certified mechanics were at the controls. For unknown reasons, the aircraft failed to stop at the gate, impacted the jetbridge and a TUG, causing the nose landing gear to collapse. The left wing of the Airbus impacted a Northwest Boeing 757 at an adjacent gate, causing damage to that aircraft as well.

SAFETY RELATED NEWS ARCHIVES

6 SEP 2001 A fire erupted in the no.1 engine area of British Airways Boeing 777, parked at gate A-37 at the Denver International Airport, CO. during a refueling operation. One fueler was badly injured and later died; none of the 16 crewmembers aboard the aircraft were injured. (The Denver Post). More below.

DEN01FA157

HISTORY OF FLIGHT

On September 5, 2001, at 1714 mountain daylight time, a Boeing 777-236, British registration G-VIIK, was substantially damaged during a ground fire at Denver International Airport, Denver, Colorado. The fire started when the airplane was parked at the gate unloading passengers and being refueled. The captain, first officer, a third pilot, 13 cabin crewmembers, and 10 passengers who were on board at the time of the accident, were not injured; however, the ground service refueler was fatally injured. British Airways was operating the airplane, Flight 2019 (call sign BAW91F), under Title 14 CFR Part 129. Visual meteorological conditions prevailed for the 9 hour 38 minute cross-country flight that originated from London, United Kingdom.

The airplane departed Gatwick International Airport, London, United Kingdom, at 0713 with 256 passengers, and was cleared to land on runway 16 at Denver International Airport (DEN) Denver, Colorado, at 1646 (the scheduled arrival time was 1615). Federal Aviation Administration (FAA) Air Traffic Control (Denver tower) instructed BAW91F to contact Denver ramp control, for taxi instructions, at 1656. BAW91F was cleared to taxi to gate A37, and its flight data recorder indicates that its auxiliary power unit (APU) was started at 1658 and its engines were shut down at 1706. A British Airways Senior Air Safety Investigator stated that the airline's Boeing 777's APU is normally started during taxi-in, and the airplane's electrical load is transferred from the main engines to the APU automatically via "no-break" technology when the engines are in idle, or during shut down. The captain for the flight said that during short time turn around, ground power is not used. He said that at the time of the accident, the airplane's electrical power supply was being generated by its APU.

The refueling hydrant truck was parked under the airplane's left wing, facing aft, and outboard of the left engine. Videos taken from DEN firefighting equipment showed that the hydrant truck had been chocked, and the hydrant truck's hydrant coupler had been attached to the airport's subsurface pit hydrant. The DEN fire department's video and a United Airline's maintenance-engineer also confirmed that the refueler had grounded the truck to the pit hydrant, and bonded the truck to the airplane's left main landing gear.

The maintenance-engineer said the refueler had raised the lift platform and had attached two hoses to the airplane's left wing refueling manifold system. As the maintenance-engineer approached the hydrant truck, he noted that refueling of the airplane had already started. He further stated that he frequently saw refuelers lower their lift platforms for head clearance comfort (during the refueling), and/or to receive their refueling requirements from a maintenance-engineer. He did not remember seeing the lift platform move on this occasion.

The maintenance-engineer said he positioned himself between the airplane's left engine and the hydrant truck to tell the refueler what fuel load should be put on the airplane. He said the refueler turned towards him and leaned down, with his back to the refueling hoses, to give him the amount of fuel that remained from the previous flight. He said the refueler had the dead-man fuel control (shut off device) in his left hand, and the hydrant truck's fuel flow meter was beginning to rotate rapidly. The last reading he remembered seeing on the fuel flow meter was 60 gallons. He further noted that the hydrant truck's turbo-diesel engine was running.

As the maintenance-engineer looked up at the refueler, he observed the inboard fuel hose separate sideways (forward, in relationship to the truck) from the airplane, and flap around "violently spraying fuel in all directions." He yelled at the refueler that the "hose was loose." The maintenance-engineer was immediately soaked with fuel and even swallowed some. He said the flames propagated up from the bottom of the truck, through the open lattice of the lift platform floor, and "engulfed the fueler." He immediately ran for a large fire-extinguishing bottle.

A second maintenance-engineer was standing inboard of the left engine when he "felt the heat and turned and looked to see a huge fire had broken out at the fuel truck [hydrant truck]." The airplane's captain was standing inside the airplane near the door to the jetway. He said that a flight attendant was the first crewmember to notice the fire; her alarm motivated him to move to a jetway window to view aft. He said that he observed a "fire near [the] left engine," and he ordered all remaining persons to immediately evacuate the airplane.

A pilot standing nearby said that a large ball of fire enveloped the hydrant truck and much of the airplane's left wing; he said the heat was very intense. He yelled to another person to call the fire department. He ran to assist a maintenance-engineer in retrieving a large fire extinguisher bottle. The fire department received the call at 1714, arrived at the scene at 1717, and immediately extinguished the fire.

Several civilian witnesses, inside the concourse, made the following observations: the first witness observed "men refueling [the airplane]. I saw the hose fly up and a spray covered the vehicle (looked like a jet of water). I then saw a small fire followed by a large ball of fire engulf the vehicle. Various people were running away from the vehicle as the fire continued to grow." She said she then thought there was some "smoke" or vapor before the fire started. She recalled the fire starting from the truck, but could not be specific whether it was from the basket or the body of the vehicle. A second witness "noticed that there was a spray of clear fluid coming from around where the people were refueling the jet. I thought it could be water, but noticed a number of the people running away and then thought it must be fuel. Shortly afterwards (1 second?) I saw the fuel explode and engulf the truck and engine of the plane." During a second interview in England, this witness recalled, "seeing the fire first in the basket, then down onto the truck. The fireball then enveloped the fuel truck, then the refueler, then up below the wing to the engine with an orange flame."

A third witness said, "I was watching the servicing of British Airlines Flight 2019, when suddenly [I] saw a huge fountain of liquid (presume jet fuel) in the air followed by a huge ball of flame. As they were refueling the aircraft, I would think either the hose ruptured or the coupling failed." A fourth witness said, "I saw a flash, followed by an expanding fireball. After taking cover, it appeared the refueling stand behind [the] port wing was on fire." A fifth witness said, "[the] fire started ground."

Additional witnesses said, "I saw that [the] engine explode, fire was coming from the engine." Another said, "explosion either from the engine or right in front of the engine. The fire was surrounding the engine and wing. The fire was also spreading on the ground." Another said, "I saw what appeared to be smoke coming from the engine whilst the re-fueling truck was re-fueling. There was a sudden flash and the truck [and the] engine was engulfed in flames." Another said, the fire started from the top of the wing and came down. Another said, "I looked up to see flames that looked like they were coming from the engine on the right side. Then it looked like a truck or something behind the engine was also on fire." And one more said, "The left outboard engine was suddenly engulfed in flames. Could see a fuel truck behind this engine. Flame appeared to spread over more of the A.C in the vicinity of the left outboard engine. Fuel was burning on the ground."

According to a British Airways representative, the 26 individuals still on-board the airplane at the time of the accident were evacuated through the jetway without incident.

PERSONNEL INFORMATION

Aircraft Service International Group (ASIG) hired the refueler on October 14, 1997. ASIG records indicate that he had received training and was qualified to refuel 17 different aircraft for 10 different airlines (he was qualified on the Boeing 777 on April 27, 1999; it was not determined how many Boeing 777s he had actually fueled). He had refueled one previous airplane (a Lufthansa A340-313X), on the afternoon of the accident, using hydrant truck number 9417. He completed that refueling approximately 30 minutes before the accident. At the time of the accident, the refueler was wearing a cotton shirt, and pants made of 65 percent polyester and 35 percent cotton.

The first maintenance-engineer (with 24 years of aviation maintenance experience) said, in a Denver Police Department interview, regarding the ASIG fueler, "He is generally not the one assigned to that plane, I believe." The second maintenance-engineer (with approximately 30 years of aviation maintenance experience) said regarding the fueler, "He wasn't one of the normal guys; I haven't seen him very often."

According to the Denver Police Department, the refueler was 5 feet 11 inches tall, and weighed 160 pounds. The refueler died from his injuries on September 11, 2001. He was 24 years old.

AIRCRAFT/VEHICLE INFORMATION

General Information about the Airplane

The airplane, a Boeing 777-236, was a twin engine, turbofan aircraft with a maximum gross takeoff weight of 590,000 pounds, and was manufactured in 1998. At the time of the accident, there were 359 similar aircraft in use worldwide, of which British Airways operated 44. The airplane's flight deck seats four, and an additional 14 cabin crew positions were located in the cabin area along with seats for a maximum of 267 passengers. Two General Electric Model GE-90 engines powered the airplane with a maximum takeoff thrust at Denver, Colorado, of 90,000 pounds each. The GE-90 engines were suspended by pylons from each wing, and their outer cowling dimension was 13.3 feet in diameter at their greatest point. A representative from British Airways said that at the time of the accident, the airplane had completed approximately 2,100 cycles, and had approximately 14,000 flight hours. He said that the airplane's records suggest that the airplane had been refueled approximately 2,000 times.

Airplane's Fuel System

The airplane was equipped with three fuel tanks, with a maximum capacity of 45,200 gallons of fuel. There were two fueling stations, one on the leading edge of each wing. Both stations contained two refueling adapters, but there was only one refueling control panel and it was located at the left wing refueling station.

The under-wing refueling panel was located approximately 43 feet outboard of the centerline of the aircraft, or 64 inches outboard horizontally from the engine. The refueling panel on the Boeing 777 was originally designed to be approximately 50 feet outboard of the centerline (approximately 19 feet from the ground), to place it further from the engine. Because the Boeing 777's wing is one of the highest from the ground in the industry, the original location for the refueling panel would have required refueling-hydrant trucks to be supplementally stabilized with outriggers to meet American National Standards Institute, ANSI/SIA A92.7 (Airline Ground Support Vehicle-Mounted Lift Devices) requirements. To avoid the need for outriggers on refueling-hydrant trucks, the refueling panel was moved 13 feet inboard, to its present location, which is approximately 17 feet 6 inches from the ground.

The airplane's fueling manifold system provide four single-point connections (two on each wing), each equipped with a three-lug adapter ring for attaching the refueling nozzle. The adapter ring geometry is an industry standard specified in MS24484. The adapter rings on the B-777 are made from a copper, nickel, and aluminum alloy (C95500; aluminum-bronze), heat treated for strength enhancement. The adapter rings had a machined shear groove, which was designed to fail in case a refueler drives away with the nozzles still attached to the airplane. The adapter's design was meant to prevent leaks by protecting the airplane's fuel system during a mechanical overload. At the time of the accident, the airplane was equipped with its original refueling adapter rings.

Ground Fuel Supply and Dispensing

Fuel (aviation Jet A) from Denver International Airport's fuel farm currently flows south towards the three east-west passenger concourses in four 20-inch in diameter pipes at 185 psi (pounds per square inch). Two pipes are on the east side of the concourses, and two are on the west side. One pipe from each pair services the north side of the concourses and the other the south side. Only the east side was in operation on the day of the accident. The distribution pipes that travel parallel to the concourses are 16-inch pipes and narrow down to 14-inch pipes, and have a static pressure of 150 psi. Each airplane-parking gate has a subsurface pit hydrant, which is fed by a 6-inch pipe at 120 psi. During refueling operations, pit hydrant pressure may vary from 80 to 120 psi. Current fuel demands at Denver International Airport require only 4 of their 16 fuel pumps (located at the fuel farm) to move an estimated 1 million gallons of fuel per day. The fuel distribution system is designed to provide uniform pressures at all of the gate pit hydrants and to dissipate fuel pressure surges, which are created by multiple starts and stops of refueling operations.

The hydrant dispenser, mounted on a 1999 Ford F550 chassis (ASIG #9417; total miles on the odometer, 1,024), provided final filtering, metering, and pressure control for fuel entering an airplane. The truck was powered by a 7.3L turbocharged diesel engine. The hydrant dispenser was constructed to reach the Boeing 777 refueling station, which at 17 feet 6 inches is the highest in the commercial aviation fleet. The chassis and cab met standard automotive design criteria. The muffler was located under the passenger's seat, and its tail pipe was directed towards the right side of the cab. The hydrant dispenser, mounted on the truck's rear chassis, met all National Fire Protection Association (NFPA) standards. The lift platform was located directly behind the cab.

The hydrant dispenser's components, including the hydraulically actuated lift platform, filter, valves, meter, and hoses were constructed and assembled at Tampa, Florida during April and May 2001. The completed vehicle was shipped to Denver, Colorado, on May 9, 2001, and went into service on May 22, 2001. The vehicle was inspected daily, and a more extensive inspection was accomplished every 30 days in accordance with the requirements of the Air Transport Association 103 standard. The last 30-day inspection occurred on August 24, 2001.

The hydrant dispenser was equipped with two vertical cylinder pressure surge protectors, which led to a 250-gallon filter vessel. The dispenser had a maximum rated flow capability of 755 gallons per minute (gpm). The last non-restricted flow test of the hydrant dispenser was on August 24, 2001, and had a maximum flow of 540 gpm, with a nozzle pressure of 38 psi. Down stream from the filter was a Jac-Riser hose assembly, which provided the flexibility needed for the 4 foot by 7 foot lift platform to move up and down. The lift platform had two swivel fuel manifolds that delivered pressurized fuel to two 10-foot long Goodyear Wingcraft 2 1/2-inch (inner diameter) aircraft fueling hoses (type c, grade 2). According to representatives of the BF Goodrich Company, the hoses met or exceeded the requirements of American Petroleum Institute no. 1529 and National Fire Protection Association no. 407 specifications. The hydrant dispenser, including all hoses, valves, and filter vessel, had an estimated static fuel capacity of 400 gallons.

The two hoses were equipped with nozzles and ferrules in March 2001. These hoses had a strength test rating of 20,000 pounds and were strength test rated (ferrule to ferrule) at approximately 1,600 to 1,800 pounds. Their outer covers were electrically semi-conductive. The assembled hoses were hydrostatically tested to 200 percent (600 psi) of their maximum 300 psi operating limit. Each hose weighed 17.2 pounds (1.72 pounds/foot), and contained 17.1 pounds (.255 gallons/foot; 6.7 pounds/gallon) of fuel. Each nozzle and hardware weighed 15.5 pounds, which brought the total operating weight of each hose to approximately 50 pounds.

Ground Refueler Controls and Refueling Procedures

According to a United Airlines Fuel Technical Services Senior Staff Engineer, when positioning a hydrant dispenser truck next to a Boeing 777, it is important to orient the truck in such a way as to maximize the available hose length. This is done by making sure that the lift platform's refueling manifolds are located directly under the airplane's refueling panel and that the airplane's refueling panel is located inside the parameters of the lift platform, i.e., inside the lift platform's railing. Additionally, he said, correct truck positioning would minimize the possibility of the refueling hose hooking on something.

The United Airlines refueling instructor said that he teaches the refuelers to "lift the platform as close as they can to the airplane's wing. Do this because the hose and nozzle are so heavy, that to reach higher than your head is very difficult." He said that he teaches them to "always lower the platform some (12 to 36 inches), before initiating fuel flow…for physical comfort reasons."

The refueler controlled the fuel flow with a dead-man switch, which needed to be held continuously open for fuel to flow. The compressed air lines, which come from the switch, activated three valves. The first valve was an on-off valve located on the subsurface pit hydrant. The second valve was the coupler valve, that connected the hydrant dispenser to the pit hydrant. The coupler valve provided both shutoff and pressure control functions. The normal fuel pressure differential (pressure drop), from the pit hydrant through the hydrant dispenser to the nozzles, was 60 to 80 psi. The third valve was an inline valve, located down stream from the filter, and it was also a combination valve which controlled on-off flow as well as fuel pressure. The control valves could be set to deliver a maximum fuel pressure of 50 psi at the nozzles [The Boeing pressure refueling guide cautions refuelers to not use more than 55 psi, because using more than this pressure could cause damage to the airplane's refueling system components]. The three valves opened sequentially, and each took 18 to 24 seconds to activate. Stabilized fuel flow is normally achieved through the whole hydrant dispenser system in 1 to 1.5 minutes.

At the beginning of each refueling, the stabilized flow rate is approximately 500 to 540 gpm, decreasing to an estimated 200 gpm as the airplane's tanks fill. The hydrant dispenser valves are capable of closing in 3 to 5 seconds. The industry standard allows up to a 5 percent overrun of the established flow rate to perform an emergency shut down.

During normal refueling operations, the truck's engine is left running to provide compressed air and hydraulic pressure for the lift platform.

METEOROLOGICAL INFORMATION

At 1720, the weather conditions at Denver International Airport (elevation 5,431 feet), were as follows: wind from the southwest at 12 miles per hour (mph), gusts to 16 mph; temperature 85 degrees Fahrenheit; relative humidity 26 percent; runway 17L surface temperature 104 degrees Fahrenheit. The estimated high temperature for the day was 89 degrees Fahrenheit, at 1500.

WRECKAGE AND IMPACT INFORMATION

The airplane was found parked on the ramp at Gate A-37, on a heading of 175 degrees. The hydrant dispenser truck was under the left wing, facing aft. Damage to the airplane was limited to thermal damage to the lower composite leading edge panels, the refueling control panel, outboard portions of the left engine fan cowl and thrust reverser. The hydrant truck received more fire damage on its right side (the wind was from left to right), burning tires, hoses, and damaging many other components. The engine compartment was only lightly sooted in a few places. The exhaust pipe, leading to the muffler was discolored; it was caramel in color.

The hydrant dispenser system's fuel flow meter read 176 gallons. The refueling lift platform's two swivel fuel manifolds were located on the 4-foot wide right side of the lift platform. The hose attached to the upper manifold was found still attached to the airplane's outboard refueling adapter. The hose attached to the lower swivel fuel manifold had separated from the airplane's inboard refueling adapter ring, and was found dangling over the front upper railing of the lift platform between the truck's cab and the elevated lift platform. The three lugs from the airplane's refueling adapter ring were found separated and located inside the fuel hose nozzle's locking collar. The nozzle's locking collar displayed three equally spaced deformations that matched the lugs from the adapter ring.

TESTS AND RESEARCH

Beginning September 10, 2001, both the failed refueling inboard adapter ring and its adjacent outboard adapter ring were examined at the Boeing Company in Renton, Washington, under the supervision of an NTSB investigator. One of the first tests performed was the axial loading of the adjacent (outboard) refueling adapter. The test was stopped after one of its three lugs failed at 9,616 pounds. Additional test results on both adapter rings included the following: Both adapter rings chemical compositions, ultimate tensile strengths, and hardness values all were found to be within specification limits. Macroscopically, there was no visible evidence of pre-existing damage to any of the failed (accident) lugs. The cadmium plating was removed from all parts of both rings, and a fluorescent penetrant inspection of the parts revealed no anomalies (flaws or cracks). The failed adapter ring's six attachment flanges were found to be "slightly" bent up 0.005 to 0.002 inches.

Boeing Materials Technology's (BMT) engineering report states: "Optical and scanning electron microscopy confirmed the three fractures on part 1 [failed adapter ring] initiated and propagated by ductile separation. No indications of slow growth crack mechanisms or corrosion were observed." NTSB metallurgists reviewed the complete reports.

The original Boeing engineering drawing for the adapter rings, Sweeney Drawing C56-2510 revision E, dated 14 June 1993, specifies that the adapter rings shall be made from an aluminum-bronze heat treated material (C95500 per Federal Specification QQ-C-390B). A Boeing representative stated that QQ-C-390B requires that C95500 meet compositional and mechanical requirements only, and not all metallurgical characteristics, i.e., stress-strain curves, microstructure, nor phase ratios, must be identical.

For example, the stress-strain curves of the accident adapter ring and its adjacent adapter ring did vary in profile. According to a metallurgist with the National Transportation Safety Board: "Although exhibiting the same features, the detailed shapes of stress strain curves are affected by many factors, including alloy, temperature, test machine setup and operation, microstructure, and other factors."

Additionally, the BMT engineering report states that the inboard and outboard adapter rings were observed metallographically to have a different subgrain structure. The inboard adapter was composed of beta phase grains outlined with a light-etching, copper-rich alpha phase; whereas, the outboard adapter was predominately beta phase without the grain boundary outlining alpha phase.

The United Kingdom's Air Accidents Investigation Branch (AAIB) investigator, who attended the initial BMT laboratory studies stated, "the failure surfaces of the 'sister' adaptor ring were examined under an optical microscope and were visibly different in surface texture [microstructure] to those of the fracture surfaces from the 'accident' adaptor ring. The actual fracture characteristics and angles were very similar between the 'sister' ring and the 'accident' ring."

The American Society for Metals (ASM) reference book, ASM Specialty Handbook: Copper and Copper Alloys, describes C95500 microstructure as follows:

"As-cast or annealed structures consist of alpha crystals plus kappa precipitates. Small quantities of metastable beta may exist. Heat-treated structures consist of tempered beta martensite with very fine reprecipitated alpha needles and kappa precipitates. Some undissolved equiaxed alpha crystals may be evident, depending on the actual composition and thermal history."

Engineering Systems, Inc. (ESI), a firm contracted by ASIG, also examined the two adapter rings. ESI reported that both adapter rings met chemical analysis, hardness testing, and ultimate strength requirements for Federal Specifications QQ-C-390B and the ASTM specifications. They did find an "overall markedly different appearance between the microstructure of the material from the inboard (Part 1) and outboard (Part 2) refueling flanges." They described the microstructure of the inboard adapter as "a well defined grain structure of martensitic beta phase outlined by distinct boundaries of alpha phase." They described the outboard adapter's microstructure as "exclusively a martensitic beta phase." ESI said "the presence of alpha phase grain boundaries indicates that the inboard refueling flange was either not heat treated or heat treated at too low of a temperature, too short a time or not quenched properly."

BMT performed several follow-up tests with material from the inboard adapter, the outboard adapter, and C95500 plate material, under Safety Board supervision. They heated samples from the inboard adapter and plate material to "erase" the effects of any previous heat-treating, which resulted in as-cast conditioning of the samples. They re-heat treated them using ASTM B 148-93 (C95500 compositional and mechanical requirements subsequent to QQ-C-390B) suggested heat treatment procedures, plus several variations. According to BMT, these experiments demonstrated that "there are a substantial number of microstructures that can result from the different heat treatment parameters and chemical compositions allowed per QQ-C-390B [and subsequent ASTM B 148-93]. Equilibrium and metastable phase diagrams further show the complexity of C95500. The as-received part 1 [failed adapter] microstructure can likely be produced only by a very similar composition and heat treatment." Additionally, BMT stated that these tests verified that the as-received inboard adapter was a product of heat treatment.

BMT cut two notched flat test coupons from each adapter ring to evaluate ultimate and yield strength properties. They demonstrated that the ultimate tensile strength of all four samples exceeded the requirements of QQ-C-390B. Although BMT initially reported yield strength values for the samples, BMT later stated that these values were not reliable. According to Boeing representatives, "Due to the limited material available and resulting small test coupons, the yield strength [and elongation measurements] of the adapter could not be reliably determined."

ESI acquired a copy of BMT's original yield strength test results; they were 51.5 and 52.7 ksi for Part 1, and 77.8 and 71.9 ksi for Part 2. According to reports written by ESI and submitted to the Safety Board, the ESI reports stated that the failed adapter ring yield strength results were below the QQ-C-390B required specification of 60 ksi. They further stated that "the ASTM specifications define the yield strength as the stress producing an elongation under load of 0.5 percent. Using the stress-strain curves from the BMT tensile tests, the yield strengths were recalculated to be 33.8 ksi for specimen 1A and 32.9 ksi for specimen 1B. These yield strengths are significantly below the mechanical requirements specified by the ASTM standard."

BMT's yield strength testing procedures followed American Society for Testing Materials (ASTM) publication E8-03 guidelines. The four notched flat test coupons did not meet the size or shape recommended in E8-03, because of the limited material available in the adapter rings. A BMT metallurgist said that resultant shape of the test coupons required that a stress concentration factor (Kt) of 1.2 be assigned. Additionally, BMT used the offset 0.2 percent method in determining yield strength, because this followed the ASTM E8-03, section 7.7.1, note 28, recommended referee method. A BMT representative said "the measured properties of such specimens [from the accident adapter ring] will differ from properties measured in a standard specimen by some factor X. X will not necessarily be equal to Kt but will likely fall between 1.0 and Kt. Therefore it would not be appropriate to simply multiply measured properties by Kt before comparing to reference standards. The exact Kts for the accident specimens were never calculated. A Boeing representative said: "Although the exact heat treat lot of the [accident] adapter ring material was not established, a review of production records for the adapters found that all candidate lots had a yield strength in excess of the specification requirements." Safety Board metallurgists reviewed BMT's data and reports.

Boeing stated that the airplane's fueling manifold system was designed for 120 psi working pressure, 240-psi proof pressure and 360 psi burst pressure. Deformations in aircraft refueling manifold systems have been noted at 150 to 180 psi. Boeing published a refueling pressure limit of 50 psi; however, Boeing stated that momentary fuel pressure surges of 80 to 100 psi are common during refueling. Boeing calculated that if direct fuel pressure were to cause the failure, a fuel pressure of approximately 1,360 psi would be required to generate the 9,616 pounds of force required to fail the lugs.

No material deformations were identified within the airplane's fueling manifold system.

The airplane's refueling manifold port, with adapter ring, was designed with a 12.5-degree forward orientation from vertical. BMT performed vertical pull tests on new production refueling adapters. Their test results were consistent with the circumstance that, collectively, the three nozzle attachment lugs can support an excess of 10,000 pounds. At the request of the NTSB, BMT laboratory calculated the adapter ring lug load capability for cases in which loads were applied from 0 to 90 degrees measured from the nozzle centerline. The testing load was applied 20 inches below the adapter lug plane to accommodate the refueling nozzle, its ferrules, and the rigidity of the hose. Calculations from these tests indicated that the adapter ring's weight bearing capability dropped-off as the off center angle increased. The results of the calculations were checked against tests conducted at 0 and 90 degrees with agreement. At 30 degrees of load application, all nozzle attachment variations failed below 1,000 pounds of load.

The relative position of the hydrant dispenser truck and its lift platform to the airplane's refueling panel was derived from two studies that were conducted subsequent to the accident. These two studies were reviewed by Safety Board investigators, and consisted of the following:

(1) A photogrammetric study, by Engineering Systems Inc. (contracted by ASIG), using all available photographs was performed, which positioned the hydrant dispenser truck to the airplane. Their report, dated September 19, 2002, gave a precise depiction of the airplane's left wing fueling control panel relative to the refueler's lift platform. This study indicates that the inboard refueling point was outside of the railing, on the left side of the lift platform, and just forward of the aft terminus of the lift platform.

(2) Photogrammetric work by Boeing indicates that the bottom of the lift platform, at the time of the accident, was 91 inches above the ground. The floor construction material was approximately 3 inches thick, add the 91 inches (total of 94 inches) and the lift platform floor would have been approximately 9 feet 8 inches below the refueling control panel. This study also documented the top of the railing of the lift platform, which was 135.2 inches above the ground (or 75 inches below the refueling panel).

The distance of the floor of the lift platform from the refueling panel was additionally documented from still pictures which were made from a Denver Fire Department video camera which was mounted on its lead fire truck. These pictures show an ASIG employee, along with a Denver fireman, climbing a ladder to enter the lift platform after the fire was put out. The 6 foot 1 inch tall employee is shown standing on the lift platform's middle railing (23 inches above the floor) and reaching up to disconnect the outboard refueling hose. The 6 foot 4 inch tall fireman (with boots and hat on) is seen bracing the employee with his hands; the top of his hat is shown to be level with the ASIG employee's heart. A Safety Board review of the pictures revealed that the distance from the ASIG employee's heart to the top of his head was approximately 18 inches, and his head was between 20 to 22 inches below the refueling panel. These numbers add up to 9 feet 8 inches, and approximately replicates the Boeing study.

Due to the refueler's height (5 feet 11 inches), and the weight of the refueling equipment, these studies provide data that is consistent with the refueler positioning the platform closer to the airplane while attaching the nozzles and then lowered the platform to the position it was found in after he connected the refueling nozzles to the airplane's refueling adapters.

A white mark, triangular in shape (approximately 115 degrees), was found by ESI on the inboard (accident) refueling hose. A Federal Aviation Administration (FAA) Inspector, from Tampa, Florida (the refueling truck had been moved to Tampa International Airport), along with ASIG personnel, reattached the refueling hose to its original refueling manifold, in March 2003. The team determined that when the rubber hose was reattached, the white mark was located 73 inches from the hose's attachment to the lower swivel manifold, and the white mark was approximately 8 inches short of aligning with the lift platform's left forward protective corner bumper (approximately 81 inches). The FAA Inspector stated that the marking was "consistent with the general shape of the bumper." Subsequently, he had the bumper removed from the lift platform's railing. He stated the following: "The marking was consistent with [the] area around the bottom of the cushion in dimension and thickness. When the cushion was minimally distorted by hand, the bottom area was consistent with the mark on the hose assembly."

At the NTSB's request, The Goodyear Tire & Rubber Company performed a stretch analysis test on an exemplar refueling hose. They determined that approximately 380 pounds of force (11.6 percent stretch) was required to stretch the 69 inches of rubber hose (minus ferrules) 8 inches.

The photogrammetric studies provided the point in space where the left forward railing's corner was (in relation to the airplane) and the point in space where the 20 inch extended adapter centerline was at the time of the accident. Graphic, geometric calculations were produced by the NTSB. The calculated angle (from the lift platform's left forward railing corner (with protruding protective guard) to the adapter's extended centerline) indicate that an approximate 52 degree off-axis load would have been applied to the adapter ring if the lift platform had been lowered. At this angle, the adapter ring lug's failure limits would have been between 350 and 700 pounds of load. This calculated load would have increased an unknown amount during the pressurization of the refueling hose, with the commencement of refueling.

Subsequent to this accident, another study was performed by Dukes Transportation Services, Inc. (a maker of aircraft refueling hydrant trucks) for Exxon-Mobil and American Airlines. They attached an electronic "fish-scale (rated to 5,000 pounds)" vertically to two differently designed hydrant trucks, which were designed to service B-777 aircraft. The refueling lift platforms were slowly lowered until the suspended scale supported all of the platform weight. Several test variations were performed, and the results were consistently between 1,000 and 1,200 pounds (without fuel in the hoses or their manifolds). The Safety Board received a copy of the test results, which are included as attachments to this report.

The Safety Board requested the assistance of Wright-Patterson Air Force Base's Materials Integrity Branch in Ohio, to determine if they could attribute the white angular mark found on the fuel hose to the white plastic bumper from the lift platform railing by means of microscope based Fourier Transform Infrared spectrometry and micro X-Ray Fluorescence. The lead investigator for the laboratory said, after looking at the hose and the original photographs, that "the contact mark observed was not as pronounced as that shown in the submitted figures [photographs]." The hose had been shipped several times (unprotected), before it arrived at the laboratory.

The June 5, 2003, Materials Integrity Branch laboratory report states that "no evidence was identified to indicate the specified contact mark was formed due to contact with the bumper." The report further states that "contact may have occurred without leaving any evidence (i.e., material transfer or abrasion). This last possibility is made more plausible by the relative toughness and abrasion resistance of the bumper material."

The corner bumper guard also exhibited areas of a black transferred material with a chalky texture. Tests were not performed on this material. Additionally, some parallel abrasions were observed at one edge of the corner bumper guard between the outer and lower surfaces.

Observations and research by Safety Board investigators revealed that hydrant trucks can vary significantly in their design. There are no national or international standards for aircraft refueling equipment or procedures governing refueling operations. Both the equipment and the procedures vary from operator to operator, airport to airport, and oil company to oil company.

The Handbook of Aviation Fuel Properties, states that the auto ignition temperature (AIT) of Jet A kerosene grade turbine fuel (1 atmosphere) is 238 degrees C (460 degrees F). At this temperature, Jet A fuel spontaneously ignites under laboratory conditions without a spark or flame. Jet A fuel vapor has a flash ignition point (based on the elevation at the accident site, of 5,431 feet) of between 114 to 120 degrees F. At this temperature, Jet A fuel vapor will ignite under laboratory conditions given an adequate ignition source. By contrast, according to the Chief Scientific and Technical Advisor to the FAA for Fuel System Design, atomized Jet A fuel (a mist cloud of suspended liquid particles with a sphere of vapor around it) will ignite at approximately 60 degrees Fahrenheit with the same atmospheric conditions, and an open flame or spark. He said that determining the source of ignition is difficult with this type of situation. If a mist cloud is ignited, the flame propagation path is initially very lean (excess air) and all of the fuel is consumed leaving no unburned carbon as evidence.

Two companies have introduced modifications to help position hydrant dispenser trucks during single person operations. One company has introduced a light under the lift platform, pointing straight up, which reported aids in night operations. Another company is beginning to install sunroofs in the cabs of their trucks so that the driver can see the refueling station location. Additionally, industry groups such as the International Aviation Transportation Association (IATA), Aviation Fuel Working Group (AFWG) and the National Fire Protection Association (NFPA) Technical Committee of Aircraft Fueling are examining the need for changes to existing industry standards and practices. The AFWG has formed a Fuel Safety Task Force for this purpose.

Safety Board investigators could not identify another accident similar to this accident (in which the adapter ring failed while under full refueling flow, and the nozzle completely separated from the airplane).

ADDITIONAL INFORMATION

The airplane, including all components and logbooks, was released to a British Airways representative on September 8, 2001. The refueling truck was released to the Aircraft Service International Group on January 29, 2002.